Serious Invasions of Privacy in the Digital Era Introduction Pirate Party Australia would like to thank the Australian Law Reform Commission (ALRC) and the Federal Government for conducting this review and providing an opportunity for stakeholders and other interested organisations such as Pirate Party Australia to submit on such an important issue as privacy invasion. Privacy is a United Nations recognised human right frequently taken for granted, and frequently disregarded. Invasions of privacy have the capacity to damage reputations, mental health, safety, security, and financial well­being. About Pirate Party Australia Pirate Party Australia is a political party registered under the Commonwealth Electoral Act 1918 (Cth). The Party was founded in late 2008, and competed in its first Federal Election in 2013. The Party’s main areas of concern are intellectual property rights (predominantly copyright and patents), privacy rights, increased governmental transparency, and opposition to censorship. Pirate Party Australia is a member of a worldwide movement that began in Sweden in 2006, and has since spread to more than 40 different countries. Pirate Parties have been elected to all levels of government — local, state, national and supranational — with more than 40 state seats in Germany, three seats in the Icelandic Parliament, and two Members of the European Parliament. Questions Principles guiding reform Question 1: What guiding principles would best inform the ALRC’s approach to the Inquiry and, in particular, the design of a statutory cause of action for serious invasion of privacy? What values and interests should be balanced with the protection of privacy? The right to personal privacy is fundamental to the dignity of every individual in society. Breaches in privacy can cause serious personal distress and psychological harm and should be treated seriously by the law. While the right to privacy is important, a distinction needs to be made between personal activities and activities in the public sphere. The public has an overriding right to know about commercial activities, political activities and any activity where transparency is in the interests of justice. In addition, fundamental protections for freedom of expression need to be taken into account. When balancing this with privacy concerns the question "can the expression occur effectively without relying on a breach of privacy?" must be asked. There is also a need for law enforcement agencies (LEAs) to investigate illegal activities and an exception needs to be made for investigations of specific and serious illegal activities. When investigations call for a breach of an individual's privacy, Pirate Party Australia believes a warrant must be sought and issued by a competent judicial authority, such as a judge or magistrate. There must be no blanket ability afforded to LEA's to trawl through the private information of individuals as it contravenes basic checks and balances of a free and democratic society. The impact of a statutory cause of action Question 2: What specific types of activities should a statutory cause of action for serious invasion of privacy prevent redress? The ALRC is particularly interested in examples of activities that the law may not already adequately prevent or redress. The causes of action recommended by the VLRC (for the misuse of private information and intrusion upon seclusion) are appropriate ways to provide legal redress for serious invasions of privacy. A non­exhaustive list would act as an aid in determining whether a breach of privacy has occurred. An exhaustive list would be inappropriate, as it risks excluding cases where privacy has been invaded, but not adequately defined by examples, and also fails to keep pace with social and technological changes. A non­exhaustive list should cover the following: ● The misuse of information where there is a reasonable expectation of privacy, including personal photos, videos and other forms of communication (such as email). It is important to take into account the intended recipients and whether the information was intended to be shared, such as on social media. This should not extend to cover unintentional distribution of private material to a broader audience through a fault of the potential victim. An example would be their failure to correctly understand privacy settings and accidentally post private information in a public manner — the individual owes a duty of care to themselves. ● Intrusion upon seclusion may include situations where the information is obtained through illegal means such as hacking, theft or trespass. There should be the ability to seek civil redress in such cases. Question 3: What specific types of activities should the ALRC ensure are not unduly restricted by a statutory cause of action for serious invasion of privacy? Pirate Party Australia believes there are a number of areas that should not be unduly restricted by any serious invasion of privacy legislation. In situations where activities that occur in public spaces are filmed, photographed or otherwise captured there should be a limited or prohibited cause of action. While privacy invasions can occur in public spaces, cameras have become ubiquitous with most people having one in their mobile phones. The intent of the person filming, taking photos, and so on, needs to be taken into account when judging if privacy has been breached. Merely appearing in the background of a shot should not be grounds for a breach in privacy. Journalists should be given broad exemptions when covering public figures and events. Journalists serve an important role in society by increasing transparency and informing the public. The right for the public to know about the public and professional activities of powerful and influential individuals should override expectations of privacy in most cases, although there should still be protection for personal and private activities of public figures. In cases where a cause of action is available, the evidentiary burden of a breach of privacy in a public place should be on the plaintiff. There should be a requirement that the plaintiff prove on the balance of probabilities that the defendant's actions in a public environment infringed on their privacy to an unreasonable degree. Invasion of privacy Question 4: Should an Act that provides for a cause of action for serious invasion of privacy (the Act) include a list of examples of invasions of privacy that may fall within the cause of action? If so, what should the list include? Pirate Party Australia believes a list of examples would risk being interpreted too narrowly and fail to encompass the myriad of ways in which privacy could be breached. As technology changes, community expectations of privacy may change with them. Broad examples, such as the VLRC proposals outlined in Question 1, would protect the privacy of individuals in unforeseen circumstances. Question 5: What, if any, benefit would there be in enacting separate causes of action for: ● misuse of private information; and ● intrusion upon seclusion? These two types of privacy breach are significantly different in form. Misuse of private information is capable of significantly harming the well­being of the victim through the sharing of personal information, including credit card details and medical records and enabling identity theft. Intrusion upon seclusion has the ability to cause psychological distress through embarrassment and fear for personal safety. With adequate delineation, it would be appropriate to enact separate causes of action as described. Pirate Party Australia sees them as being sufficiently dissimilar to warrant separate causes of action, but acknowledges that there will be instances where the two occur simultaneously (as in the case of stalking, for example). With that said, it is probable with the high degree of information­sharing that occurs (such as between limbs of corporations and between government departments) that misuse of private information would be the more frequent cause of action. Privacy and the threshold of seriousness Question 6: What should be the test for actionability of a serious invasion of privacy? For example, should an invasion be actionable only where there exists a ‘reasonable expectation of privacy’? What, if any, additional test should there be to establish a serious invasion of privacy? The basic test of actionability for a serious invasion of privacy should be whether, in the circumstances, the plaintiff had a reasonable expectation of privacy. This should take into account the various subjective elements of the circumstances, such as whether the plaintiff sought reassurance that their privacy would be protected, whether they belonged to a class of person whose privacy a reasonable person would protect, the nature of the interaction and relationship between the parties, and so on. Pirate Party Australia believes this should be a sufficient test for actionability. Privacy and public interest Question 7: How should competing public interests be taken into account in a statutory cause of action? For example, should the Act provide that: ● competing public interests must be considered when determining whether there has been a serious invasion of privacy; or ● public interest is a defence to the statutory cause of action? There are many situations where the public interest should take precedence over the right to privacy, and as such the Act should provide a public interest defence to a cause of action. Pirate Party Australia supports a two­step test modelled on that used in the UK: a requirement for the plaintiff to demonstrate that privacy was reasonably expected, and then for the defendant to demonstrate that exposure of such information is in the public interest (McKennit v Ash [2008] 1 QB 73). This would adequately balance the competing interests in any serious breach of privacy claim. Question 8: What guidance, if any, should the Act provide on the meaning of ‘public interest’? Pirate Party Australia believes that 'public interest' should not be narrowly defined in the Act. An explicit definition may exclude activities that are in the public interest.